mirror of
https://github.com/hanzoui/custom-nodes-security-scan.git
synced 2026-10-30 20:56:54 +00:00
64 lines
2.3 KiB
Python
64 lines
2.3 KiB
Python
# Copyright (C) 2014-2017 Cuckoo Foundation.
|
|
# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
|
|
# See the file 'docs/LICENSE' for copying permission.
|
|
|
|
from _winreg import HKEY_CURRENT_USER
|
|
|
|
from lib.common.abstracts import Package
|
|
|
|
class PPT(Package):
|
|
"""PowerPoint analysis package."""
|
|
PATHS = [
|
|
("ProgramFiles", "Microsoft Office", "POWERPNT.EXE"),
|
|
("ProgramFiles", "Microsoft Office", "Office10", "POWERPNT.EXE"),
|
|
("ProgramFiles", "Microsoft Office", "Office11", "POWERPNT.EXE"),
|
|
("ProgramFiles", "Microsoft Office", "Office12", "POWERPNT.EXE"),
|
|
("ProgramFiles", "Microsoft Office", "Office14", "POWERPNT.EXE"),
|
|
("ProgramFiles", "Microsoft Office", "Office15", "POWERPNT.EXE"),
|
|
("ProgramFiles", "Microsoft Office", "Office16", "POWERPNT.EXE"),
|
|
("ProgramFiles", "Microsoft Office 15", "root", "office15", "POWERPNT.EXE"),
|
|
("ProgramFiles", "Microsoft Office", "root", "Office16", "POWERPNT.EXE"),
|
|
]
|
|
|
|
REGKEYS = [
|
|
[
|
|
HKEY_CURRENT_USER,
|
|
"Software\\Microsoft\\Office\\12.0\\Common\\General",
|
|
{
|
|
# "Welcome to the 2007 Microsoft Office system"
|
|
"ShownOptIn": 1,
|
|
},
|
|
],
|
|
[
|
|
HKEY_CURRENT_USER,
|
|
"Software\\Microsoft\\Office\\12.0\\Powerpoint\\Security",
|
|
{
|
|
# Enable VBA macros in Office 2007.
|
|
"VBAWarnings": 1,
|
|
"AccessVBOM": 1,
|
|
|
|
# "The file you are trying to open .xyz is in a different
|
|
# format than specified by the file extension. Verify the file
|
|
# is not corrupted and is from trusted source before opening
|
|
# the file. Do you want to open the file now?"
|
|
"ExtensionHardening": 0,
|
|
},
|
|
],
|
|
[
|
|
HKEY_CURRENT_USER,
|
|
"Software\\Microsoft\\Office\\Common\\Security",
|
|
{
|
|
# Enable all ActiveX controls without restrictions & prompting.
|
|
"DisableAllActiveX": 0,
|
|
"UFIControls": 1,
|
|
},
|
|
],
|
|
]
|
|
|
|
def start(self, path):
|
|
powerpoint = self.get_path("Microsoft Office PowerPoint")
|
|
return self.execute(
|
|
powerpoint, args=["/S", path], mode="office",
|
|
trigger="file:%s" % path
|
|
)
|